Distributed denial-of-service attack mitigation with reduced latency

Abstract

An apparatus for mitigating a DDoS attack in a networked computing system includes at least one detector coupled with a corresponding router in the networked computing system. The detector is configured: to obtain network flow information from the router regarding current data traffic to at least one host; to compare the current data traffic to the host with stored traffic patterns associated with at least one prior DDoS attack; and to generate an output indicative of a match between the current data traffic and at least one of the stored traffic patterns. The apparatus further includes at least one mitigation unit coupled with the at least one detector. The mitigation unit is configured: to receive the output indicative of the match between the current data traffic and at least one of the stored traffic patterns; and to initiate a DDoS attack mitigation action in response to the received output.

Description

FIELD OF THE INVENTION[0001]The present invention relates generally to the electrical, electronic and computer arts, and, more particularly, to mitigation of distributed denial-of-service attacks in a networked computing environment.BACKGROUND OF THE INVENTION[0002]In the context of computing, a denial-of-service (DoS) attack is an attempt to make a machine or network resource unavailable to its intended users. A distributed denial-of-service (DDoS) attack is an attack in which multiple compromised computer systems attack a target resource, such as a server, router, firewall, website, or other network resource, and cause a denial of service for users of the targeted resource. A flood of incoming messages, connection requests, malformed data packets and the like creates a stream of bogus traffic which, when transmitted to the target system, forces it to slow down or even crash and shut down. Since a server or other network resource can only process a limited number of requests at any...

AI Technical Summary

Benefits of technology

This invention reduces the time between when a DDoS attack starts and the person responsible for stopping it can start to protect against it. It uses information from previous attacks to make better predictions and avoid false alarms. The new techniques can be easily integrated into existing systems without adding much extra complexity.

Problems solved by technology

A flood of incoming messages, connection requests, malformed data packets and the like creates a stream of bogus traffic which, when transmitted to the target system, forces it to slow down or even crash and shut down.

Since a server or other network resource can only process a limited number of requests at any given time, if an attacker overloads the target resource with requests, it can't process the requests of its legitimate users, thereby resulting in a “denial of service” because the users are prevented from accessing that resource.

Targeted routers, servers and firewalls, all of which have limited processing capability, can be rendered unavailable to process valid transactions, and can fail under the load.

To make detection even more difficult, such attacks might also spoof the source address; that is, misrepresent the Internet Protocol (IP) source address that supposedly generated the request to prevent identification.

Since DDoS attacks are by definition distributed, it can be very difficult to mitigate attack traffic when the attacking source IP addresses are so widespread.

Furthermore, a growing trend among DDoS attackers is to use sophisticated spoofing techniques and essential protocols (rather than nonessential protocols that can be blocked) to make DDoS attacks even more stealthy and disruptive.

These attacks, which use legitimate application protocols and services, are very difficult to identify and defeat; employing broad packet-filtering or rate-limiting measures simply completes the attacker's desired objective by shutting down the system, causing denial of service to legitimate users.

Images